@cosmicdrift/kumiko-framework 0.388.0 → 0.390.0

package/dist/jobs/job-runner-context.js

@@ -6,11 +6,14 @@ import { createDerivativesContext } from "../derivatives/derivatives-context.js"
 import { createSystemUser } from "../engine/system-user.js";
 import { InternalError } from "../errors/index.js";
 import { createTenantFileContext } from "../files/file-handle.js";
-import { createEscapeHatchReporter, createMetricsForFactory } from "../observability/index.js";
+import { createEscapeHatchReporter } from "../observability/escape-hatch-report.js";
+import { createMetricsForFactory } from "../observability/index.js";
 import { configAccessorFactoryOf } from "../pipeline/config-accessor-factory.js";
+import { buildContextServices } from "../pipeline/context-services.js";
 import { createGatedIdentitySwitch } from "../pipeline/system-identity-switch.js";
 import { buildPersonalDataGate, parseWriteOrigin } from "../pipeline/write-origin.js";
-import { attemptNumberOf, createJobLogger, handlerPayloadOf, isFinalAttempt, isJobTriggerEvent, jobSubjectKey, missingDbProxy, tenantIdOfJobData, } from "./job-runner-helpers.js";
+import { createJobAppendEvent } from "./job-append-event.js";
+import { attemptNumberOf, createJobLogger, handlerPayloadOf, hasDeferBudgetLeft, isFinalAttempt, isJobTriggerEvent, jobSubjectKey, missingDbProxy, tenantIdOfJobData, } from "./job-runner-helpers.js";
 // Tenant-visible failure record (JobDefinition.tenantVisibleFailure). The
 // subject is read from the handler payload, so it is resolved where the
 // payload is built, not in the callbacks.
@@ -72,7 +75,7 @@ function buildJobDbFacets(scope, facetInput) {
     const { jobDef, tenantId, writeOrigin } = input;
     const personalDataGate = writeOrigin ? buildPersonalDataGate(registry, writeOrigin) : undefined;
     const configDb = context.db; // @cast-boundary db-operator
-    // Shared by the config accessor and ctx.derivatives below — both need the
+    // Shared by the config accessor and ctx.services.derivatives below — both need the
     // same tenant-scoped db, and building it twice would let the two calls
     // drift apart. Always "system" mode regardless of the job's own
     // systemScope() status (pre-existing, not something this change alters)
@@ -85,6 +88,7 @@ function buildJobDbFacets(scope, facetInput) {
             db: configDb,
             tenantId,
             mode: "system",
+            reason: "job context db for cross-tenant jobs, ctx.systemDb exposure is gated by isSystemJob",
             grants: {
                 projectionRegistry: registry,
                 ...(personalDataGate && { personalDataGate }),
@@ -120,12 +124,12 @@ function buildJobServiceFacets(scope, facetInput, tenantScopedDb) {
     const { context, registry } = scope;
     const { input, systemUser } = facetInput;
     const { tenantId } = input;
-    // Mirror dispatch-shared.ts buildHandlerContext: ctx.files must resolve
+    // Mirror dispatch-shared.ts buildHandlerContext: ctx.services.files must resolve
     // through the same _fileProviderResolver for jobs as for write-handlers,
-    // otherwise event-triggered jobs silently get an unresolved ctx.files.
+    // otherwise event-triggered jobs silently get an unresolved ctx.services.files.
     const fileResolver = context._fileProviderResolver;
     const files = fileResolver ? createTenantFileContext(fileResolver, tenantId) : context.files;
-    // Same buildHandlerContext parity as ctx.files above: ctx.notify/ctx.config
+    // Same buildHandlerContext parity as ctx.services.files above: ctx.notify/ctx.config
     // must resolve for jobs the same way they do for write-handlers, or an
     // app-author job calling ctx.notify(...)/ctx.config(...) hits a TypeError
     // at runtime the write-handler path never would.
@@ -138,7 +142,7 @@ function buildJobServiceFacets(scope, facetInput, tenantScopedDb) {
             secrets: context.secrets,
         })
         : undefined;
-    // Mirror dispatch-shared.ts: ctx.derivatives needs files+db, same
+    // Mirror dispatch-shared.ts: ctx.services.derivatives needs files+db, same
     // tenant-scoped db the config accessor above uses.
     const derivatives = files && tenantScopedDb
         ? createDerivativesContext({ files, registry, db: tenantScopedDb, tenantId })
@@ -190,6 +194,24 @@ function createJobDefer(jobName, bullJob, token) {
         return { kind: "job-deferral", delayMs };
     };
 }
+function buildJobServices(scope, parts) {
+    const { files, derivatives, selfRunner } = parts;
+    return buildContextServices(scope.context, {
+        ...(files && { files }),
+        ...(derivatives && { derivatives }),
+        // Expose the runner so handlers can chain a follow-up job. Symmetric with
+        // how the command-dispatcher hands write-handlers their jobRunner.
+        ...(selfRunner !== undefined && { jobRunner: selfRunner }),
+    });
+}
+function buildJobObservability(scope, log) {
+    const { meter } = scope.context;
+    return {
+        log,
+        metricsFor: createMetricsForFactory(meter),
+        ...(meter && { meter }),
+    };
+}
 function buildJobContext(scope, input) {
     const { jobName, bullJob, token, rawData, tenantId, triggeredById, attempt, finalAttempt } = input;
     const systemUser = createSystemUser(tenantId);
@@ -212,12 +234,24 @@ function buildJobContext(scope, input) {
     // this run (see createJobTriggerEventConsumer).
     const rawTriggerEvent = rawData["_triggerEvent"];
     const triggerEvent = isJobTriggerEvent(rawTriggerEvent) ? rawTriggerEvent : undefined;
+    const jobLogger = createJobLogger(input.logs);
     const jobContext = {
         defer: createJobDefer(jobName, bullJob, token),
-        ...scope.context,
+        canDefer: token !== undefined &&
+            bullJob.moveToDelayed !== undefined &&
+            hasDeferBudgetLeft(rawData, input.jobDef.maxDefers),
         db: jobDb ?? missingDbProxy(jobName),
-        files,
-        derivatives,
+        events: {
+            append: createJobAppendEvent({
+                registry: scope.registry,
+                jobDb,
+                tenantId,
+                systemUser,
+                jobName,
+            }),
+        },
+        services: buildJobServices(scope, { files, derivatives, selfRunner }),
+        lifecycle: scope.context.signal ? { signal: scope.context.signal } : {},
         ...(notify !== undefined && { notify }),
         ...(config !== undefined && { config }),
         ...(systemDb && { systemDb }),
@@ -226,18 +260,14 @@ function buildJobContext(scope, input) {
         // workers can reach projections/jobs without the app author duplicating
         // it into `context` (the JobContext contract guarantees `registry`).
         registry: scope.registry,
-        // Expose the runner so handlers can chain a follow-up job. Symmetric with
-        // how the command-dispatcher hands write-handlers their jobRunner.
-        ...(selfRunner !== undefined && { jobRunner: selfRunner }),
         systemUser,
         triggeredBy: triggeredById !== null ? { id: triggeredById, tenantId } : null,
         attempt,
         finalAttempt,
-        log: createJobLogger(input.logs),
-        metricsFor: createMetricsForFactory(scope.context.meter),
+        obs: buildJobObservability(scope, jobLogger),
         ...(triggerName !== undefined && { triggerName }),
         ...(triggerEvent !== undefined && { triggerEvent }),
-        ...dispatchFacets,
+        dispatch: dispatchFacets,
     };
     return { jobContext, config };
 }

package/dist/jobs/job-runner-execution.d.ts

@@ -1,5 +1,5 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import type { JobDeferral } from "../engine/types/index.ts";
+import type { JobDeferral } from "@cosmicdrift/kumiko-types/handlers";
 import type { JobRun } from "./job-runner-context.ts";
 import { type JobRunnerScope } from "./job-runner-scope.ts";
 import type { JobInvocation } from "./job-runner-types.ts";

package/dist/jobs/job-runner-execution.js

@@ -1,11 +1,13 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
 import { UnrecoverableError } from "bullmq";
 import { requestContext } from "../api/request-context.js";
+import { runInSystemRowLevelSecurityScope } from "../db/row-level-security-scope.js";
 import { qnScope } from "../engine/qualified-name.js";
 import { InternalError } from "../errors/index.js";
 import { scrubLogText } from "../logging/index.js";
-import { emitJobLastSuccess, withEscapeHatchAuditScope } from "../observability/index.js";
-import { DEFAULT_MAX_DEFERS, HANDLER_DEFER_COUNT_KEY, isJobDeferral, priorDeferCountOf, readTraceContext, resolveJobTz, tenantFailureMessageKey, } from "./job-runner-helpers.js";
+import { withEscapeHatchAuditScope } from "../observability/escape-hatch-report.js";
+import { emitJobLastSuccess } from "../observability/standard-metrics.js";
+import { DEFAULT_MAX_DEFERS, HANDLER_DEFER_COUNT_KEY, hasDeferBudgetLeft, isJobDeferral, priorDeferCountOf, readTraceContext, resolveJobTz, tenantFailureMessageKey, } from "./job-runner-helpers.js";
 import { laneForJob, logFailedAttempt } from "./job-runner-scope.js";
 function buildOutcomeMeta(run, messageKey, unrecoverable = false) {
     const { jobDef, subjects } = run;
@@ -48,7 +50,7 @@ async function runJobHandler(scope, run, correlation) {
 }
 function assertDeferBudget(run) {
     const maxDefers = run.jobDef.maxDefers ?? DEFAULT_MAX_DEFERS;
-    if (priorDeferCountOf(run.rawData, HANDLER_DEFER_COUNT_KEY) >= maxDefers) {
+    if (!hasDeferBudgetLeft(run.rawData, run.jobDef.maxDefers)) {
         // The counter never resets, so a retry would hit the cap again.
         throw new UnrecoverableError(`Job "${run.jobName}" was deferred ${maxDefers} times (maxDefers); giving up.`);
     }
@@ -135,7 +137,7 @@ export async function executeJobInSpan(scope, run) {
                 : {}),
         },
         ...(parentContext ? { parent: parentContext } : {}),
-    }, () => runAndRecordJob(scope, run, { requestId, correlationId })));
+    }, () => runInSystemRowLevelSecurityScope("job execution span reads job rows of every tenant", () => runAndRecordJob(scope, run, { requestId, correlationId }))));
 }
 export async function applyHandlerDeferral(scope, run, bullJob, deferral, token) {
     if (!deferral || token === undefined || !bullJob.moveToDelayed)

package/dist/jobs/job-runner-gates.d.ts

@@ -1,5 +1,5 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import type { JobDefinition } from "../engine/types/index.ts";
+import type { JobDefinition } from "@cosmicdrift/kumiko-types/config";
 import { type JobRun } from "./job-runner-context.ts";
 import { type JobRunnerScope } from "./job-runner-scope.ts";
 import type { JobInvocation } from "./job-runner-types.ts";

package/dist/jobs/job-runner-gates.js

@@ -1,4 +1,3 @@
-/// <reference types="temporal-polyfill/global" preserve="true" />
 import { prepareJobRun } from "./job-runner-context.js";
 import { attemptNumberOf, buildRetryBullOpts, DEFER_COUNT_KEY, deferDelayMs, isFinalAttempt, priorAttemptsOf, priorDeferCountOf, } from "./job-runner-helpers.js";
 import { ACTIVE_TENANT_IDS_QUERY_NAME, perTenantChildJobId } from "./job-runner-schedulers.js";

package/dist/jobs/job-runner-helpers.d.ts

@@ -1,11 +1,12 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import type { ConfigAccessor } from "@cosmicdrift/kumiko-types/config";
+import type { ConfigAccessor, JobDefinition } from "@cosmicdrift/kumiko-types/config";
+import type { JobDeferral, JobTriggerEvent } from "@cosmicdrift/kumiko-types/handlers";
+import type { Meter, SerializedTraceContext, Tracer } from "@cosmicdrift/kumiko-types/observability";
 import type { TzContext } from "@cosmicdrift/kumiko-types/tz-context";
 import type { JobsOptions, Queue } from "bullmq";
 import type { TenantDb } from "../db/tenant-db.ts";
-import type { AppContext, JobDeferral, JobDefinition, JobRunIn, JobTriggerEvent } from "../engine/types/index.ts";
+import type { AppContext, JobRunIn } from "../engine/types/index.ts";
 import type { Logger } from "../logging/types.ts";
-import type { Meter, SerializedTraceContext, Tracer } from "../observability/index.ts";
 import type { JobInvocation, JobLogEntry, JobSubjectValue } from "./job-runner-types.ts";
 export declare function isJobTriggerEvent(value: unknown): value is JobTriggerEvent;
 export declare function stampGatedWriteOrigin(data: Record<string, unknown>): void;
@@ -27,11 +28,15 @@ export declare const DEFER_BACKOFF_MAX_DOUBLINGS = 5;
 export declare function readTraceContext(data: Record<string, unknown>): SerializedTraceContext | undefined;
 export declare function captureTraceContext(tracer: Tracer): SerializedTraceContext | undefined;
 export declare function startQueueDepthPolling(queue: Queue, lane: JobRunIn, meter: Meter): Promise<ReturnType<typeof setInterval>>;
-export declare function parseRedisOpts(url: string): {
+type RedisConnectionOptions = {
     host: string;
     port: number;
     db?: number | undefined;
+    username?: string | undefined;
+    password?: string | undefined;
+    tls?: Record<string, never> | undefined;
 };
+export declare function parseRedisOpts(url: string): RedisConnectionOptions;
 export declare const BOOT_REDIS_TIMEOUT_MS = 10000;
 export declare const STOP_QUEUE_READY_TIMEOUT_MS = 1000;
 export declare const BOOT_GATE_SLOW_WARN_MS = 60000;
@@ -46,6 +51,7 @@ export declare const FAILED_JOB_RETENTION_AGE_SEC = 604800;
 export declare function maxRetryWindowMs(jobDef: JobDefinition): number;
 export declare function isJobDeferral(value: unknown): value is JobDeferral;
 export declare function priorDeferCountOf(data: Record<string, unknown>, key: string): number;
+export declare function hasDeferBudgetLeft(data: Record<string, unknown>, maxDefers: number | undefined): boolean;
 export declare function handlerPayloadOf(data: Record<string, unknown>): Record<string, unknown>;
 export declare function tenantIdOfJobData(data: Record<string, unknown>): string;
 export declare function deferDelayMs(deferMs: number, deferCount: number): number;
@@ -56,3 +62,4 @@ export declare function isActiveBefore(other: {
     readonly id: string | undefined;
     readonly processedOn: number | undefined;
 }): boolean;
+export {};

package/dist/jobs/job-runner-helpers.js

@@ -5,7 +5,7 @@ import { SYSTEM_TENANT_ID } from "../engine/types/index.js";
 import { InternalError } from "../errors/index.js";
 import { isKumikoError } from "../errors/kumiko-error.js";
 import { createFallbackLogger, scrubLogText } from "../logging/index.js";
-import { emitJobQueueDepth } from "../observability/index.js";
+import { emitJobQueueDepth } from "../observability/standard-metrics.js";
 import { TENANT_TIMEZONE_CONFIG_KEY } from "../pipeline/tenant-timezone-config-key.js";
 import { isPersonalDataGated } from "../pipeline/write-origin.js";
 import { createTzContext, isValidIanaTimeZone } from "../time/index.js";
@@ -210,6 +210,12 @@ export function parseRedisOpts(url) {
     if (parsed.pathname.length > 1) {
         result.db = Number(parsed.pathname.slice(1));
     }
+    if (parsed.username)
+        result.username = decodeURIComponent(parsed.username);
+    if (parsed.password)
+        result.password = decodeURIComponent(parsed.password);
+    if (parsed.protocol === "rediss:")
+        result.tls = {};
     return result;
 }
 // redisOpts carries no connectTimeout/retry cap, so an unreachable Redis
@@ -299,6 +305,9 @@ export function priorDeferCountOf(data, key) {
     const prior = data[key];
     return typeof prior === "number" ? prior : 0;
 }
+export function hasDeferBudgetLeft(data, maxDefers) {
+    return priorDeferCountOf(data, HANDLER_DEFER_COUNT_KEY) < (maxDefers ?? DEFAULT_MAX_DEFERS);
+}
 export function handlerPayloadOf(data) {
     const payload = {};
     for (const [k, v] of Object.entries(data)) {

package/dist/jobs/job-runner-scope.d.ts

@@ -1,7 +1,10 @@
+import type { JobDefinition } from "@cosmicdrift/kumiko-types/config";
+import type { DispatchWriteRef } from "@cosmicdrift/kumiko-types/handlers";
+import type { Tracer } from "@cosmicdrift/kumiko-types/observability";
 import type { Queue } from "bullmq";
-import type { AppContext, DispatchWriteRef, JobDefinition, JobRunIn, Registry, TenantId } from "../engine/types/index.ts";
+import type { AppContext, JobRunIn, Registry, TenantId } from "../engine/types/index.ts";
 import type { createFallbackLogger } from "../logging/index.ts";
-import type { EscapeHatchProcessDedup, EscapeHatchReportWindow, Tracer } from "../observability/index.ts";
+import type { EscapeHatchProcessDedup, EscapeHatchReportWindow } from "../observability/escape-hatch-report.ts";
 import type { DistributedLock } from "../pipeline/distributed-lock.ts";
 import type { JobRunner, JobRunnerOptions } from "./job-runner-types.ts";
 export type JobRunnerScope = {

package/dist/jobs/job-runner-scope.js

@@ -13,21 +13,21 @@ export function laneForJob(def) {
 // lane (jobDef.runIn is static), but walking both is cheap and avoids
 // a subtle bug if someone ever reassigns a job to a different lane
 // between deploys while old queue contents are still draining.
+// One getJobs per queue reads the requested lists in a single Lua script, so a job
+// moving from waiting to active between two separate reads can no longer vanish
+// from the count; that gap let a third dispatch pass the cap in CI.
 // `activeOnly` + `self` serve the defer check, which runs inside the job being
 // counted: it must not see waiting jobs or itself, and only counts jobs that
 // became active before it. Without that order, workers that fetch a burst of
 // jobs together all see each other as active and all defer, again and again.
 export async function isOverPerTenantLimit(scope, jobName, tenantId, max, countFilter = {}) {
     const { queues } = scope;
-    const results = await Promise.all([
-        queues.api.getActive(),
-        queues.worker.getActive(),
-        ...(countFilter.activeOnly ? [] : [queues.api.getWaiting(), queues.worker.getWaiting()]),
-    ]);
+    const types = countFilter.activeOnly ? ["active"] : ["active", "waiting"];
+    const results = await Promise.all([queues.api.getJobs(types), queues.worker.getJobs(types)]);
     let count = 0;
     for (const list of results) {
         for (const j of list) {
-            if (j.name !== jobName)
+            if (j === undefined || j.name !== jobName)
                 continue;
             if (countFilter.self && !isActiveBefore(j, countFilter.self))
                 continue;

package/dist/jobs/job-runner-types.d.ts

@@ -1,5 +1,6 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import type { AppContext, DispatchWriteRef, JobRunIn, JobTriggerEvent, Registry, SessionUser, TenantId } from "../engine/types/index.ts";
+import type { DispatchWriteRef, JobTriggerEvent } from "@cosmicdrift/kumiko-types/handlers";
+import type { AppContext, JobRunIn, Registry, SessionUser, TenantId } from "../engine/types/index.ts";
 export type JobLogEntry = {
     level: "info" | "warn" | "error";
     message: string;

package/dist/jobs/job-runner.js

@@ -1,13 +1,17 @@
 import { DelayedError, Queue, Worker } from "bullmq";
 import { Redis } from "ioredis";
 import { requestContext } from "../api/request-context.js";
+import { assertNoActiveRowLevelSecurityScope, runInSystemRowLevelSecurityScope, } from "../db/row-level-security-scope.js";
 import { createTenantDb, createUncheckedSystemDb } from "../db/tenant-db.js";
 import { bridgeStub } from "../engine/bridge-stub.js";
 import { createSystemUser } from "../engine/system-user.js";
 import { SYSTEM_TENANT_ID } from "../engine/types/index.js";
 import { InternalError } from "../errors/index.js";
 import { createFallbackLogger } from "../logging/index.js";
-import { createEscapeHatchProcessDedup, createEscapeHatchReporter, createEscapeHatchReportWindow, flushEscapeHatchAudits, getFallbackTracer, registerStandardMetrics, } from "../observability/index.js";
+import { createEscapeHatchProcessDedup, createEscapeHatchReporter, createEscapeHatchReportWindow, flushEscapeHatchAudits, } from "../observability/escape-hatch-report.js";
+import { getFallbackTracer } from "../observability/fallback.js";
+import { registerStandardMetrics } from "../observability/standard-metrics.js";
+import { attachOutsideTransaction } from "../pipeline/attach-outside-transaction.js";
 import { createDistributedLock } from "../pipeline/distributed-lock.js";
 import { RedisKeys } from "../pipeline/redis-keys.js";
 import { cronRepeatOptions } from "./cron-repeat-options.js";
@@ -61,7 +65,12 @@ export function createJobRunner(options) {
             return undefined;
         return async () => {
             const systemUser = createSystemUser(SYSTEM_TENANT_ID);
-            const systemModeDb = createTenantDb({ db, tenantId: SYSTEM_TENANT_ID, mode: "system" });
+            const systemModeDb = createTenantDb({
+                db,
+                tenantId: SYSTEM_TENANT_ID,
+                mode: "system",
+                reason: "system jobs run without tenant scope and read across tenants by design",
+            });
             const reportEscapeHatch = createEscapeHatchReporter({
                 handler: ACTIVE_TENANT_IDS_QUERY_NAME,
                 tenantId: SYSTEM_TENANT_ID,
@@ -71,8 +80,7 @@ export function createJobRunner(options) {
                 window: escapeHatchReportWindow,
             });
             const result = await handler.handler({ type: ACTIVE_TENANT_IDS_QUERY_NAME, payload: {}, user: systemUser }, {
-                db: systemModeDb,
-                dbOutsideTransaction: systemModeDb,
+                db: attachOutsideTransaction(systemModeDb, systemModeDb),
                 systemDb: createUncheckedSystemDb(systemModeDb, undefined, reportEscapeHatch),
                 registry,
                 ...bridgeStub(),
@@ -198,7 +206,11 @@ export function createJobRunner(options) {
         getSelfRunner: () => selfRunner,
         getDispatchWriteRef: () => dispatchWriteRef,
     };
-    async function handleJob(bullJob, token) {
+    // Per invocation, never around the worker loop: the loop itself must stay outside any scope.
+    function handleJob(bullJob, token) {
+        return runInSystemRowLevelSecurityScope("job runner executes jobs of every tenant", () => handleJobInScope(bullJob, token));
+    }
+    async function handleJobInScope(bullJob, token) {
         const perTenantTarget = perTenantTargetOf(bullJob.name);
         if (perTenantTarget !== undefined) {
             await fanOutPerTenantJob(scope, bullJob, perTenantTarget);
@@ -264,6 +276,9 @@ export function createJobRunner(options) {
                 // a hanging process instead of a non-zero exit.
                 await worker?.close();
                 worker = null;
+                // A failed start() may never be followed by stop(); the abandoned gate must not keep
+                // writing to DB/Redis while the process shuts down.
+                await settleAbandonedBootGates(Math.min(bootRedisTimeoutMs, STOP_QUEUE_READY_TIMEOUT_MS));
                 throw err;
             }
             finally {
@@ -343,6 +358,7 @@ export function createJobRunner(options) {
     }
     const runnerApi = {
         async start() {
+            assertNoActiveRowLevelSecurityScope("JobRunner worker");
             // skip: enqueuer-only runner — no BullMQ worker, no cron schedules,
             // no boot jobs. The API-process (runLocalJobs=false) lands here; it
             // still holds the queue-clients so dispatch()/handleEvent() can
@@ -572,7 +588,7 @@ export function createJobRunner(options) {
                 data[TRACE_CONTEXT_KEY] = traceCtx;
             // Propagate correlation from the scheduling request into the job
             // execution context. The worker re-enters requestContext.run with
-            // this value so ctx.appendEvent / executor writes during the job
+            // this value so ctx.events.append / executor writes during the job
             // stamp the same correlation as the HTTP request that scheduled it.
             const reqCtx = requestContext.get();
             if (reqCtx?.correlationId)

package/dist/jobs/max-per-tenant.d.ts

@@ -1,4 +1,4 @@
-import type { JobDefinition } from "../engine/types/index.ts";
+import type { JobDefinition } from "@cosmicdrift/kumiko-types/config";
 export declare const DEFAULT_MAX_PER_TENANT_DEFER_MS = 1000;
 export type ResolvedMaxPerTenant = {
     readonly limit: number;

package/dist/logging/index.d.ts

@@ -1,5 +1,4 @@
-export type { LoggerOptions } from "./pino-logger.ts";
 export { createLogger } from "./pino-logger.ts";
-export { scrubLogText, scrubLogValue } from "./scrub.ts";
+export { scrubLogText } from "./scrub.ts";
 export type { Logger } from "./types.ts";
 export { createFallbackLogger, setProcessLogger } from "./utils.ts";

package/dist/logging/index.js

@@ -1,3 +1,3 @@
 export { createLogger } from "./pino-logger.js";
-export { scrubLogText, scrubLogValue } from "./scrub.js";
+export { scrubLogText } from "./scrub.js";
 export { createFallbackLogger, setProcessLogger } from "./utils.js";

package/dist/logging/pino-logger.js

@@ -1,5 +1,5 @@
 import pino, {} from "pino";
-import { observabilityContext } from "../observability/index.js";
+import { observabilityContext } from "../observability/context.js";
 import { requestLogFields } from "./request-log-fields.js";
 const REDACTED_KEYS = [
     "password",

package/dist/logging/utils.d.ts

@@ -7,4 +7,5 @@ type FallbackLogger = {
 };
 export declare function setProcessLogger(logger: Logger | null): void;
 export declare function createFallbackLogger(namespace: string, logger?: (Pick<Logger, "error"> & Partial<Pick<Logger, "info" | "warn" | "debug" | "child">>) | undefined): FallbackLogger;
+export declare function createFallbackFullLogger(namespace: string): Logger;
 export {};

package/dist/logging/utils.js

@@ -101,3 +101,9 @@ export function createFallbackLogger(namespace, logger) {
         },
     };
 }
+// A full Logger for contexts whose typed surface promises one (ctx.obs.log) but that have no
+// app logger wired; child() returns the same instance because there is no sink to scope.
+export function createFallbackFullLogger(namespace) {
+    const logger = { ...createFallbackLogger(namespace), child: () => logger };
+    return logger;
+}

package/dist/migrations/index.d.ts

@@ -1,4 +1,4 @@
-export { assertKumikoSchemaCurrent, type ChecksumMismatch, detectKumikoDrift, formatKumikoDriftReport, type KumikoDriftReport, SchemaDriftError, } from "./kumiko-drift.ts";
-export { createPendingRebuildsTable, type EnqueueProjectionRebuildDeps, type EnqueueProjectionRebuildResult, enqueueProjectionRebuild, listPendingRebuilds, type PendingRebuildRun, PROJECTION_REBUILD_JOB, pendingRebuildsTable, queueRebuildsFromMarkers, type RunPendingRebuildsOptions, rebuildProjectionOrMultiStream, reportPendingRebuildRun, runPendingRebuilds, } from "./pending-rebuilds.ts";
-export { createPiiBackfillStateTable, type PiiEventBackfillOptions, type PiiEventBackfillResult, type PiiRebuildRun, piiAnnotationFingerprint, piiBackfillStateTable, runPiiEventBackfill, } from "./pii-event-backfill.ts";
+export { assertKumikoSchemaCurrent, SchemaDriftError, } from "./kumiko-drift.ts";
+export { enqueueProjectionRebuild, listPendingRebuilds, PROJECTION_REBUILD_JOB, queueRebuildsFromMarkers, rebuildProjectionOrMultiStream, reportPendingRebuildRun, runPendingRebuilds, } from "./pending-rebuilds.ts";
+export { runPiiEventBackfill } from "./pii-event-backfill.ts";
 export { buildProjectionTableIndex } from "./projection-table-index.ts";

package/dist/migrations/index.js

@@ -1,8 +1,8 @@
 // Drizzle-free gate (kumiko/migrations system) — the canonical boot-gate.
-export { assertKumikoSchemaCurrent, detectKumikoDrift, formatKumikoDriftReport, SchemaDriftError, } from "./kumiko-drift.js";
+export { assertKumikoSchemaCurrent, SchemaDriftError, } from "./kumiko-drift.js";
 // Persistente Pending-Rebuild-Queue (survives Rebuild-Failures + Crashes).
-export { createPendingRebuildsTable, enqueueProjectionRebuild, listPendingRebuilds, PROJECTION_REBUILD_JOB, pendingRebuildsTable, queueRebuildsFromMarkers, rebuildProjectionOrMultiStream, reportPendingRebuildRun, runPendingRebuilds, } from "./pending-rebuilds.js";
+export { enqueueProjectionRebuild, listPendingRebuilds, PROJECTION_REBUILD_JOB, queueRebuildsFromMarkers, rebuildProjectionOrMultiStream, reportPendingRebuildRun, runPendingRebuilds, } from "./pending-rebuilds.js";
 // Boot-time backfill: re-encrypts plaintext events after a PII annotation was added.
-export { createPiiBackfillStateTable, piiAnnotationFingerprint, piiBackfillStateTable, runPiiEventBackfill, } from "./pii-event-backfill.js";
+export { runPiiEventBackfill } from "./pii-event-backfill.js";
 // tableName → projection-name, for application-side projection rebuilds.
 export { buildProjectionTableIndex } from "./projection-table-index.js";

package/dist/migrations/pending-rebuilds.d.ts

@@ -2,7 +2,7 @@ import type { DbConnection } from "../db/connection.ts";
 import type { Registry } from "../engine/types/index.ts";
 import type { JobRunner } from "../jobs/index.ts";
 import type { Logger } from "../logging/types.ts";
-import { type RebuildResult } from "../pipeline/index.ts";
+import type { RebuildResult } from "../pipeline/projection-rebuild.ts";
 export declare const pendingRebuildsTable: import("@cosmicdrift/kumiko-types/executor-brand").WritableSchemaTable;
 export declare function createPendingRebuildsTable(db: DbConnection): Promise<void>;
 /** Reads rebuild markers from freshly applied migrations and queues the

package/dist/migrations/pending-rebuilds.js

@@ -16,7 +16,7 @@ import { readRebuildMarker } from "../db/rebuild-marker.js";
 import { tableExists } from "../db/schema-inspection.js";
 import { unsafePushTables } from "../db/table-push.js";
 import { createFallbackLogger } from "../logging/utils.js";
-import { rebuildMultiStreamProjection, rebuildProjection, } from "../pipeline/index.js";
+import { rebuildMultiStreamProjection, rebuildProjection } from "../pipeline/index.js";
 import { buildProjectionTableIndex } from "./projection-table-index.js";
 export const pendingRebuildsTable = pgTable("kumiko_pending_rebuilds", {
     tableName: text("table_name").primaryKey(),

package/dist/migrations/pii-event-backfill.js

@@ -17,6 +17,7 @@ import { backfillEventPiiEncryptionBatch, } from "../db/queries/backfill-pii.js"
 import { alterTableAddColumn } from "../db/queries/ddl.js";
 import { persistPiiBackfillState, readPiiBackfillState, } from "../db/queries/pii-backfill-state.js";
 import { upsertOnConflict } from "../db/query.js";
+import { runInSystemRowLevelSecurityScope } from "../db/row-level-security-scope.js";
 import { tableExists } from "../db/schema-inspection.js";
 import { withoutStatementTimeout } from "../db/statement-timeout.js";
 import { unsafePushTables } from "../db/table-push.js";
@@ -209,7 +210,9 @@ function reportRunOutcome(log, progress) {
     }
 }
 export function runPiiEventBackfill(db, registry, options = {}) {
-    return withoutStatementTimeout(db, (unboundedDb) => backfillPiiEvents(unboundedDb, registry, options));
+    return runInSystemRowLevelSecurityScope("PII event backfill rewrites events across all tenants", () => {
+        return withoutStatementTimeout(db, (unboundedDb) => backfillPiiEvents(unboundedDb, registry, options));
+    });
 }
 async function backfillPiiEvents(db, registry, options) {
     const log = createFallbackLogger("pii-event-backfill", options.logger);

package/dist/observability/escape-hatch-report.d.ts

@@ -1,4 +1,5 @@
-import type { EscapeHatchAuditSink, EscapeHatchKind, EscapeHatchReporter, EscapeHatchUseEvent, TenantId } from "../engine/types/index.ts";
+import type { EscapeHatchAuditSink, EscapeHatchKind, EscapeHatchReporter, EscapeHatchUseEvent } from "@cosmicdrift/kumiko-types/handlers";
+import type { TenantId } from "../engine/types/index.ts";
 import type { Logger } from "../logging/types.ts";
 import type { Meter } from "./types/index.ts";
 export declare const ESCAPE_HATCH_USED_SIGNAL = "security:escape-hatch-used";

package/dist/observability/escape-hatch-report.js

@@ -40,6 +40,12 @@ const READ_WINDOW_KINDS = new Set([
 // A long-lived worker must leave an audit event inside every retention window
 // (90 days), or its crons vanish from the log once the first event is pruned.
 const PROCESS_REAUDIT_INTERVAL_MS = 24 * 60 * 60 * 1000;
+// Declared escape hatches of system crons are audited once per day and process for each
+// (handler, kind, tenant, target): the declaration, the system actor and the reason are
+// identical on every run, so repeats carry no information. The target is part of the
+// key only where it names a table (one run can write several global tables); a row target
+// would add a key and an audit event per touched foreign row.
+const TABLE_TARGET_KINDS = new Set(["global-write"]);
 // Row-level targets add a key per touched row; without a sweep a long-lived worker keeps them all.
 function sweepExpiredProcessDedup(dedup, nowMs) {
     if (nowMs - dedup.lastSweep.atMs >= PROCESS_REAUDIT_INTERVAL_MS) {
@@ -157,12 +163,13 @@ export function createEscapeHatchReporter(opts) {
             emitEscapeHatchUse(opts.meter, opts.handler, kind);
         const { processDedup } = opts;
         if (processDedup?.kinds.has(kind)) {
+            const keyTarget = TABLE_TARGET_KINDS.has(kind) ? target : undefined;
             const processKey = JSON.stringify([
                 opts.handler,
                 kind,
                 opts.tenantId,
-                target?.id ?? null,
-                target?.tenantId ?? null,
+                keyTarget?.id ?? null,
+                keyTarget?.tenantId ?? null,
             ]);
             const nowMs = now();
             const lastAuditedAt = processDedup.lastAuditedAt.get(processKey);

package/dist/observability/index.d.ts

@@ -1,16 +1,8 @@
-export { type ConsoleProviderOptions, createConsoleProvider } from "./console-provider.ts";
-export { observabilityContext } from "./context.ts";
-export { createEscapeHatchProcessDedup, createEscapeHatchReporter, createEscapeHatchReportWindow, ESCAPE_HATCH_USED_SIGNAL, type EscapeHatchProcessDedup, type EscapeHatchReportWindow, fallbackEscapeHatchReporter, flushEscapeHatchAudits, reportEscapeHatchUse, UNATTRIBUTED_ACTOR, withEscapeHatchAuditScope, } from "./escape-hatch-report.ts";
-export { getFallbackMeter, getFallbackProvider, getFallbackTracer } from "./fallback.ts";
-export { generateSpanId, generateTraceId } from "./ids.ts";
-export { buildMetricName, validateLabelKey, validateMetricName, } from "./metric-validator.ts";
-export { createMetricsForFactory, createMetricsHandle, createNoopMetricsHandle, createSafeMetricsHandle, createUnboundMetricsHandle, } from "./metrics-handle.ts";
-export { type ObservabilityWiring, prometheusMetricsEnvSchema, resolveObservabilityWiring, } from "./metrics-wiring.ts";
+export { createMetricsForFactory, createMetricsHandle, createNoopMetricsHandle, createSafeMetricsHandle, } from "./metrics-handle.ts";
+export { prometheusMetricsEnvSchema, resolveObservabilityWiring, } from "./metrics-wiring.ts";
 export { createNoopProvider } from "./noop-provider.ts";
-export { createPrometheusMeter, type PrometheusMeter, type PrometheusMeterSnapshot, serializeOpenMetrics, } from "./prometheus-meter.ts";
-export { type MetricEvent, type MetricEventHandler, RecordingMeter, } from "./recording-meter.ts";
-export { type RecordedSpan, RecordingTracer, type RecordingTracerOptions, serializeSpanContext, } from "./recording-tracer.ts";
-export { wrapRedisClient } from "./redis-wrapper.ts";
-export { DEFAULT_SENSITIVE_CONFIG, mergeSensitiveConfig, REDACTED, redactAttributes, redactHeaders, redactQueryString, redactValue, shouldRedactAttribute, } from "./sensitive-filter.ts";
-export { emitDbQuery, emitDispatcherError, emitDispatcherHandler, emitEscapeHatchUse, emitEventConsumerLag, emitEventConsumerPassOutcome, emitEventConsumerPassSkipped, emitEventConsumerPendingGaps, emitEventConsumerRearmExhausted, emitEventDispatcherListenConnected, emitHttpRequest, emitJobLastSuccess, emitJobQueueDepth, registerStandardMetrics, STANDARD_METRIC_DEFS, } from "./standard-metrics.ts";
-export type { Counter, Gauge, Histogram, Meter, MetricDefinition, MetricLabels, MetricsHandle, MetricType, ObservabilityOptions, ObservabilityProvider, SamplingConfig, SensitiveFilterConfig, SerializedTraceContext, Span, SpanAttributes, SpanAttributeValue, SpanKind, SpanStatus, StartSpanOptions, Tracer, } from "./types/index.ts";
+export { createPrometheusMeter } from "./prometheus-meter.ts";
+export { type MetricEvent, RecordingMeter, } from "./recording-meter.ts";
+export { type RecordedSpan, RecordingTracer, } from "./recording-tracer.ts";
+export { DEFAULT_SENSITIVE_CONFIG, mergeSensitiveConfig, } from "./sensitive-filter.ts";
+export type { MetricsHandle, ObservabilityOptions, ObservabilityProvider, } from "./types/index.ts";

package/dist/observability/index.js

@@ -1,16 +1,8 @@
 // Public surface of the observability module.
-export { createConsoleProvider } from "./console-provider.js";
-export { observabilityContext } from "./context.js";
-export { createEscapeHatchProcessDedup, createEscapeHatchReporter, createEscapeHatchReportWindow, ESCAPE_HATCH_USED_SIGNAL, fallbackEscapeHatchReporter, flushEscapeHatchAudits, reportEscapeHatchUse, UNATTRIBUTED_ACTOR, withEscapeHatchAuditScope, } from "./escape-hatch-report.js";
-export { getFallbackMeter, getFallbackProvider, getFallbackTracer } from "./fallback.js";
-export { generateSpanId, generateTraceId } from "./ids.js";
-export { buildMetricName, validateLabelKey, validateMetricName, } from "./metric-validator.js";
-export { createMetricsForFactory, createMetricsHandle, createNoopMetricsHandle, createSafeMetricsHandle, createUnboundMetricsHandle, } from "./metrics-handle.js";
+export { createMetricsForFactory, createMetricsHandle, createNoopMetricsHandle, createSafeMetricsHandle, } from "./metrics-handle.js";
 export { prometheusMetricsEnvSchema, resolveObservabilityWiring, } from "./metrics-wiring.js";
 export { createNoopProvider } from "./noop-provider.js";
-export { createPrometheusMeter, serializeOpenMetrics, } from "./prometheus-meter.js";
+export { createPrometheusMeter } from "./prometheus-meter.js";
 export { RecordingMeter, } from "./recording-meter.js";
-export { RecordingTracer, serializeSpanContext, } from "./recording-tracer.js";
-export { wrapRedisClient } from "./redis-wrapper.js";
-export { DEFAULT_SENSITIVE_CONFIG, mergeSensitiveConfig, REDACTED, redactAttributes, redactHeaders, redactQueryString, redactValue, shouldRedactAttribute, } from "./sensitive-filter.js";
-export { emitDbQuery, emitDispatcherError, emitDispatcherHandler, emitEscapeHatchUse, emitEventConsumerLag, emitEventConsumerPassOutcome, emitEventConsumerPassSkipped, emitEventConsumerPendingGaps, emitEventConsumerRearmExhausted, emitEventDispatcherListenConnected, emitHttpRequest, emitJobLastSuccess, emitJobQueueDepth, registerStandardMetrics, STANDARD_METRIC_DEFS, } from "./standard-metrics.js";
+export { RecordingTracer, } from "./recording-tracer.js";
+export { DEFAULT_SENSITIVE_CONFIG, mergeSensitiveConfig, } from "./sensitive-filter.js";

package/dist/observability/metric-validator.js

@@ -51,7 +51,7 @@ export function validateMetricName(name, type) {
 // r.metric() is called with `feature.name` as registered at defineFeature
 // time) — normalize "-" to "_" here so a feature like "ai-foundation"
 // resolves to the same "kumiko_ai_foundation_x" on both the registration
-// path (registry-ingest.ts) and the read path (ctx.metrics / ctx.metricsFor),
+// path (registry-ingest.ts) and the read path (ctx.obs.metrics / ctx.obs.metricsFor),
 // instead of the kebab form being rejected outright.
 export function buildMetricName(featureName, shortName) {
     const normalizedFeatureName = toKebab(featureName).replace(/-/g, "_");